[论文解读] On Physical Adversarial Patches for Object Detection

Mark Lee, J. Zico Kolter|arXiv (Cornell University)|Jun 20, 2019

Adversarial Robustness in Machine Learning参考文献 13被引用 115

一句话总结

本文提出一种物理对抗性贴片，可在对所有目标的检测中抑制 YOLOv3 的检测，即使对象距离贴片较远；并展示数字攻击和实时网页摄像头攻击优于现有的贴片方法（DPatch）。

ABSTRACT

In this paper, we demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can suppress virtually all the detected objects in the image. That is, we can place the patch anywhere in the image, causing all existing objects in the image to be missed entirely by the detector, even those far away from the patch itself. This in turn opens up new lines of physical attacks against object detection systems, which require no modification of the objects in a scene. A demo of the system can be found at https://youtu.be/WXnQjbZ1e7Y.

研究动机与目标

• Motivate the study of physical adversarial patches for object detection system vulnerabilities.
• Develop a patch-based attack that suppresses all detections rather than targeting specific objects.
• Show that a universal patch can work across varying positions, distances, and lighting conditions.
• Evaluate the attack on COCO and in real-time webcam scenarios.
• Compare performance against prior patch approaches (DPatch) and analyze why improvements occur.

提出的方法

• Formulate an untargeted patch attack using PGD with expectation over transformations applied to the patch.
• Use a patch application function A(δ, x, t) to place the patch δ on image x under transformation t and maximize the detector loss J.
• Apply clipping to keep patches within valid image values, and repeat with random restarts to mitigate non-convex optima.
• Evaluate both unclipped and clipped variants to compare against DPatch, measuring mAP and per-class AP on the COCO validation set.
• Demonstrate physical realization by printing the patch and attacking YOLOv3 in real-time via a webcam.

实验结果

研究问题

• RQ1 Can a non-overlapping adversarial patch suppress all detections in an object detector like YOLOv3?
• RQ2 How does a patch-based attack compare to prior methods such as DPatch in untargeted settings?
• RQ3 Does a physically printed patch retain adversarial effectiveness under varying distances, angles, lighting, and motion?
• RQ4 What is the impact on overall mAP and per-class AP under unclipped versus clipped attack configurations?
• RQ5 Is the attack transferable to real-time detection in physical space?

主要发现

• A non-overlapping adversarial patch can reduce YOLOv3 mAP from 55.4 to single-digit values under untargeted attacks.
• The proposed method achieves substantially lower mAP than DPatch in both unclipped and clipped settings.
• Clipped patches with transformations still yield strong suppression, with mAP as low as 7.2 in the unclipped case and 7.2 in the clipped case (Table 2 values).
• In unclipped experiments, the patch can drive mAP to as low as 0.05–0.25 depending on patch scale, outperforming DPatch’s uplifted mAP values (e.g., 9.21–39.6 range in Table 1).
• The physical patch, printed on standard paper, suppresses detections in real-time webcam experiments, though efficacy decreases with distance and requires larger patches for distant objects.